tempacc1234

So you won’t fix this plugin? I see, that’s the quality of your service. None.

Are the broken destroy functions, the insane abuse of ternary operators, the illegible code, the possibility of posting invalid URLs resulting in empty activity posts, the lack of thumbnails for remote images, the ugly styles and horrible layout, “very strict standards on our code quality”?

What about messing with the What’s new form user experience? And the difficulty to make changes without breaking everything else? Wrapping ugly HTML and CSS in ugly JS?

Do you think this is “very strict standards on our code quality”?:

<div class="bpfb_images">
<?php $rel = md5(microtime() . rand());?>
<?php foreach ($images as $img) { ?>
	<?php if (!$img) continue; ?>
	<?php if (preg_match('!^https?:\/\/!i', $img)) { // Remote image ?>
		<img src="<?php echo $img; ?>" />
	<?php } else { ?>
		<?php $info = pathinfo(trim($img));?>
		<?php $thumbnail = file_exists(bpfb_get_image_dir($activity_blog_id) . $info['filename'] . '-bpfbt.' . strtolower($info['extension'])) ?
			bpfb_get_image_url($activity_blog_id) . $info['filename'] . '-bpfbt.' . strtolower($info['extension'])
			:
			bpfb_get_image_url($activity_blog_id) . trim($img)
		;
		$target = 'all' == BPFB_LINKS_TARGET ? 'target="_blank"' : '';
		?>
		<a href="<?php echo bpfb_get_image_url($activity_blog_id) . trim($img); ?>" class="<?php echo $use_thickbox; ?>" rel="<?php echo $rel;?>" <?php echo $target; ?> >
			<img src="<?php echo $thumbnail;?>" />
		</a>
	<?php } ?>
<?php } ?>
</div>

Destroying the image handler takes several seconds, is that “very strict standards on our code quality” too?

WP core has thousands of lines of code, how many has this plugin? This plugin only has 3 front-end input fields, and one of them had an XSS vulnerability for several years, is that “very strict standards on our code quality and security best practices”?

Did all this “slip through”?

Stop treating us like we are stupid, because we are not.

Are you trying to bribe me?

OMG!

Whilst it’s regrettable and shouldn’t have been there, however, I wouldn’t consider this a true XSS vulnerability.

As far as I can see, the code injection will take place only on the client side for the user that is injecting the script. (same thing can be done by using the browser console). The injected script won’t be saved, therefore, will not affect other users. It can’t be used through reflection either.

You can use social engineering to trick someone to enter the malicious URL in the form. WTF!?

This is a legit URL:

http://www.google.si/imgres?imgurl=http://www.newslinq.com/wp-content/uploads/2014/06/ex-girlfriend-meme-14.jpg&imgrefurl=http://www.newslinq.com/ex-girlfriend-memes/&h=537&w=550&tbnid=gfZV50vHkUdoPnM:&docid=wb_0Bw7bFw4tfbM&ei=sCRKVv-xHIb3PacLaoEA&tbm=isch&ved=0CDAQMygAMfABqFQoTCP_J1rLNlckCcFYZ7DwodQi0ICA

Are you telling me you can’t add a malicious script between all that gibberish and trick someone to use that URL?

From Wikipedia:

As the JavaScript code was also processing user input and rendering it in the web page content, a new sub-class of reflected XSS attacks started to appear that was called DOM-based cross-site scripting. In a DOM-based XSS attack, the malicious data does not touch the web server. Rather, it is being reflected by the JavaScript code, fully on the client side.

Do you even know what XSS is?

XSS vulnerability in 1.6.3

Since this has been fixed i’ll publish here the report i sent to WPMU DEV so everyone can see it and choose if they want to keep using WPMU DEV’s plugins.

I was going to post this in ww.wp.xz.cn support forum, but i don’t want to f**k your users because of your incompetence. I’ll give you 24 hours to update your plugin before full disclosure.

Just another bug in your code, and this is a big one.

Enter one of the URLs below as the image URL, click the preview button and enjoy your XSS:

http://thisisnotamalicious.url"><a href=http://google.com>Click this innocent link! I swear it is safe!</a> <!--

Or just redirect to a malicious page without user interaction (change 7 to 8 if you are using https):

http://thisisnotamalicious.url"><script>var x = String(/google.com/);x = x.substring(1, x.length-1);y = location.href;window.location.replace(y.substring(0, 7) + x)</script>

Nice job, WPMU DEV. How many years with a XSS vulnerability?

This vulnerability allowed an attacker to execute arbitrary code in the client’s browser just by using an URL similar to the ones i described above. This is a very basic but very dangerous attack and it should have been fixed several years ago.

I guess this vulnerability affects every single version from 1.6.3 to the first one, but i only tested it in 1.6.3.

UPDATE NOW!

Members should not have to add this by themselves, plugins shouldn’t need this kind of modifications.

Fix your code because the style and layout are just horrible. Not to mention the quality of the code. Ternary operators everywhere and opening and closing php tags for almost every line in interface’s file are just two of many examples i could give you.

Another example is that the plugin doesn’t have thumbnails for remote images, and it just needs a one line modification and a few lines of CSS to make it responsive. It’s just laziness or incompetence, or both.

Thanks, @klyles. I already added some responsiveness to this plugin in my website but i don’t want to share any more code until they fix this plugin. It’s been broken for several years now.

“I do really understand your point there”. No, you don’t.

You missed the whole point of my review. Intentionally, i guess.

“Install the plugin, waste a lot of time trying to make it work and come to our forum to find temporary workarounds or pay for support” is not acceptable. It looks like a scam that uses a broken free plugin to lure users to your paid support. Is WPMU DEV a scam? I tried a few WPMU DEV plugins and all of them felt like very amateur work. Are you even coders?

If you want to turn around my experience, update the plugin. And i don’t mean updating it like you have been doing for more than 4 years. Update like it’s 2015, not 2010. What am i saying? This plugin doesn’t need to be updated, it needs to be rewritten. Yes, it’s that bad.

It’s really amazing the amount of time you have to waste with this plugin just to get the style right. Don’t even think in modifying the codebase because, well, it’ll be one of your worst nightmares.

Do you think that broken code is acceptable? Can WPMU DEV produce quality code at all? Take a look at the destroy functions. I’d be ashamed if this was my plugin, and i’m a very bad coder. Templates? Filters? Hooks? Nope, we better wrap HTML in ugly JS. How can we embed pictures? Let’s just throw in an img tag followed by a br tag. Divs? CSS? Thumbnails? What’s that? And i could go on and on and on…

WordPress/Buddypress community should be more demanding. We are grateful for free plugins, sure, but we should ban broken plugins and its developers. Specially when they offer paid support for their, i suppose, intentionally broken plugins. You are hurting this community more than helping it.

I’m starting to think it would be better if you just remove this plugin from this repository if you don’t plan to update it. Maybe someone capable would write a much better plugin than this one. Or Buddypress devs would make this a core feature.

I recommend not to install anything related with WPMU DEV, much less paying them for support.

Sorry, i can’t edit. I though i could edit if needed, but i can’t.

If you want to use my code, change “callback()” to “if (callback) callback()” in all the destroy functions and “function(){}” to “false” in the init fuction. The above code works, but it doesn’t update the activity stream until you refresh the page. It works perfect with this changes, at least for me.

Again, sorry. My good intentions are bigger than my coding skills 😛

Line 69:

var destroy = function (callback) {
    $container.empty();
    $('.bpfb_preview_container').empty();
    $('.bpfb_action_container').empty();
    $('#aw-whats-new-submit').show();
    $(window).off("resize.bpfb");
    if (callback) callback();
};

Line 226:

var destroy = function (callback) {
    $container.empty();
    $('.bpfb_preview_container').empty();
    $('.bpfb_action_container').empty();
    $('#aw-whats-new-submit').show();
    $(window).off("resize.bpfb");
    if (callback) callback();
};

Line 356:

var destroy = function (callback) {
    removeTempImages(function() {
        $container.empty();
        $('.bpfb_preview_container').empty();
        $('.bpfb_action_container').empty();
        $('#aw-whats-new-submit').show();
        if (callback) callback();
    });
};

Line 402:

function init () {
    $form = $("#whats-new-form");
    $text = $form.find('textarea[name="whats-new"]');
    $textContainer = $form.find('#whats-new-textarea');
    createMarkup();
    $('#bpfb_addPhotos').click(function () {
        if (_bpfbActiveHandler) {
            _bpfbActiveHandler.destroy(function() {
                _bpfbActiveHandler = new BpfbPhotoHandler();
                $("#bpfb_cancel_action").show();
                return false;
            });
        } else {
            _bpfbActiveHandler = new BpfbPhotoHandler();
            $("#bpfb_cancel_action").show();
            return false;
        }
    });
    $('#bpfb_addLinks').click(function () {
        if (_bpfbActiveHandler) {
            _bpfbActiveHandler.destroy(function() {
                _bpfbActiveHandler = new BpfbLinkHandler();
                $("#bpfb_cancel_action").show();
                return false;
            });
        } else {
            _bpfbActiveHandler = new BpfbLinkHandler();
            $("#bpfb_cancel_action").show();
            return false;
        }
    });
    $('#bpfb_addVideos').click(function () {
        if (_bpfbActiveHandler) {
            _bpfbActiveHandler.destroy(function() {
                _bpfbActiveHandler = new BpfbVideoHandler();
                $("#bpfb_cancel_action").show();
                return false;
            });
        } else {
            _bpfbActiveHandler = new BpfbVideoHandler();
            $("#bpfb_cancel_action").show();
            return false;
        }
    });
    $('#bpfb_cancel_action').click(function () {
        $(".bpfb_toolbarItem.bpfb_active").removeClass("bpfb_active");
        _bpfbActiveHandler.destroy(false);
        $("#bpfb_cancel_action").hide();
        return false;
    });
    $(".bpfb_toolbarItem").click(function () {
        $(".bpfb_toolbarItem.bpfb_active").removeClass("bpfb_active");
        $(this).addClass("bpfb_active");
    });
    $(document).on('click', '#bpfb_submit', function () {
        var params = _bpfbActiveHandler.get();
        var group_id = $('#whats-new-post-in').length ? $('#whats-new-post-in').val() : 0;
        $.post(ajaxurl, {
            "action": "bpfb_update_activity_contents",
            "data": params,
            "content": $text.val(),
            "group_id": group_id
        }, function (data) {
            _bpfbActiveHandler.destroy(false);
            $text.val('');
            $('#activity-stream').prepend(data.activity);
            /**
            * Handle image scaling in previews.
            */
            $(".bpfb_final_link img").each(function () {
                $(this).width($(this).parents('div').width());
            });
        });
    });
    $(document).on('click', '#bpfb_cancel', function () {
        $(".bpfb_toolbarItem.bpfb_active").removeClass("bpfb_active");
        _bpfbActiveHandler.destroy(false);
    });
}